Crisis communication planning is a little like holiday gift shopping – you know it has to be done, and you’ll be glad you started early.

Crisis planning requires communications professionals to keep in mind two ideas that may seem contradictory:

• It’s vital to prepare for crises by developing specific plans for likely crisis situations, such as a healthcare organization having a plan for a data breach, and then training and reviewing those plans regularly.

• When a crisis occurs, it’s equally vital to recognize that the real situation you face likely bears little resemblance to the scenario you planned and trained for – even if at first it seems to fit the template.

I saw a great illustration of this at the annual symposium of the Illinois Association of Healthcare Attorneys on Nov. 6. A plenary session titled “Prepare to Protect: Responding to Crisis” featured a real-time simulation of a fictional “digital security incident” and a follow-up panel of attorneys that discussed best practices.

In the simulation, patients began emailing a fictional Chicago hospital after receiving emails from a physician that suggested their hepatitis C test results may have been compromised. More than two hours later, the crisis team learns that the physician in question just returned from a trip to discover a break-in at his office. His laptop – and a sticky note with his passwords – are missing. In between, we watched as fictional social media posts began pouring in with questions and a brief online news story was posted.  

The fictional crisis team – the CEO, the hospital’s privacy officer and its communications director – demonstrated the difficulty of grappling with a situation where information develops slowly while the media and social media worlds are at top speed. Their interactions, as actors playing roles in a simulation who are not in real life part of the same management team, also showed the importance of planning and practicing the plan.

The team would have worked at greater speed had they discussed these issues before (not something that could have been simulated). The team also lacked all the necessary experts around the table, specifically, the chief information security officer. The CISO would have delivered information to the team about the technical side of the incident more rapidly and likely would have highlighted the danger that patients could be the targets of a phishing scam as part of this incident. Warning patients about this risk should have been an early communication step.

Post-game analysis

On the post-simulation panel, Marilyn Hanzal, privacy officer for Flatiron Health, said the key to clear thinking in a crisis is to know that you don’t know much. A communication decision-maker needs to be at the table early in these situations to help decide when to communicate with employees and patients, Hanzal added.

Carolyn Metnick, an attorney focused on health information privacy and security, said simulation exercises are vital to build rapport among outside counsel, senior leadership and the functional heads of IT, information security and communications. These exercises expose gaps in policies and procedures and highlight legal and regulatory changes that must be reckoned with.

Communication leaders in healthcare organizations should prepare a roadmap for responding to data breaches and ransomware attacks – before they occur. The three biggest benefits of planning ahead are:

• A road map provides a great framework for grappling with the crisis when it hits.

• Planning ahead leads to important internal conversations that need to happen before the pressure of a crisis.

• Planning enables a communication leader to build up “mental muscles” that you can flex during a crisis.

Whether you are looking to update your plan or need to create it from scratch, an outside communications professional brings experience with many situations you may be facing and industry best practices that will sharpen your planning. Contact me to get started.

Top image by Gerd Altmann via Pixabay

Bottom image by Annalise Batista via Pixabay